common/bruteforce.c

   1 //-----------------------------------------------------------------------------
   2 // Copyright (C) Proxmark3 contributors. See AUTHORS.md for details.
   3 //
   4 // This program is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // This program is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // See LICENSE.txt for the text of the license.
  15 //-----------------------------------------------------------------------------
  16
  17 #include "bruteforce.h"
  18 #include <string.h>
  19 #include <stdio.h>
  20
  21 uint8_t charset_digits[] = {
  22     '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
  23 };
  24
  25 uint8_t charset_uppercase[] = {
  26     'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K',
  27     'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'W',
  28     'X', 'Y', 'Z'
  29 };
  30
  31 smart_generator_t *smart_generators[] = {
  32     smart_generator_byte_repeat,
  33     smart_generator_msb_byte_only,
  34     smart_generator_nibble_sequence,
  35     NULL
  36 };
  37
  38
  39 void bf_generator_init(generator_context_t *ctx, uint8_t mode, uint8_t key_length) {
  40     memset(ctx, 0, sizeof(generator_context_t));
  41     ctx->mode = mode;
  42     ctx->key_length = key_length;
  43 }
  44
  45 int bf_generator_set_charset(generator_context_t *ctx, uint8_t charsets) {
  46     if (ctx->mode != BF_MODE_CHARSET) {
  47         return -1;
  48     }
  49
  50     if (charsets & BF_CHARSET_DIGITS) {
  51         memcpy(ctx->charset, charset_digits, sizeof(charset_digits));
  52         ctx->charset_length += sizeof(charset_digits);
  53     }
  54
  55     if (charsets & BF_CHARSET_UPPERCASE) {
  56         memcpy(ctx->charset + ctx->charset_length, charset_uppercase, sizeof(charset_uppercase));
  57         ctx->charset_length += sizeof(charset_uppercase);
  58     }
  59
  60     return 0;
  61 }
  62
  63 int bf_generate(generator_context_t *ctx) {
  64
  65     switch (ctx->mode) {
  66         case BF_MODE_RANGE: {
  67             return _bf_generate_mode_range(ctx);
  68         }
  69         case BF_MODE_CHARSET: {
  70             return _bf_generate_mode_charset(ctx);
  71         }
  72         case BF_MODE_SMART: {
  73             return _bf_generate_mode_smart(ctx);
  74         }
  75     }
  76
  77     return BF_GENERATOR_ERROR;
  78 }
  79
  80
  81 // increments values in array with carryover using modulo limit for each byte
  82 // this is used to iterate each byte in key over charset table
  83 // returns -1 if incrementing reaches its end
  84 int bf_array_increment(uint8_t *data, uint8_t data_len, uint8_t modulo) {
  85
  86     // check if we reached max value already
  87     uint8_t i;
  88     for (i = 0; i < data_len; i++) {
  89         if (data[i] < modulo - 1) {
  90             break;
  91         }
  92     }
  93
  94     if (i == data_len) {
  95         return -1;
  96     }
  97
  98     for (uint8_t pos = data_len - 1;; pos--) {
  99
 100         uint8_t prev_value = ++data[pos];
 101
 102         data[pos] = data[pos] % modulo;
 103
 104         if (prev_value == data[pos]) {
 105             return 0;
 106         } else if (pos == 0) {
 107             // we cannot carryover to next byte
 108             // with the max value check in place before, we should not reach this place
 109             return -1;
 110         }
 111     }
 112
 113     return 0;
 114 }
 115
 116 // get current key casted to 32 bit
 117 uint32_t bf_get_key32(const generator_context_t *ctx) {
 118     return ctx->current_key & 0xFFFFFFFF;
 119 }
 120
 121 // get current key casted to 48 bit
 122 uint64_t bf_get_key48(const generator_context_t *ctx) {
 123     return ctx->current_key & 0xFFFFFFFFFFFF;
 124 }
 125
 126 void bf_generator_clear(generator_context_t *ctx) {
 127     ctx->flag1 = 0;
 128     ctx->flag2 = 0;
 129     ctx->flag3 = 0;
 130     ctx->counter1 = 0;
 131     ctx->counter2 = 0;
 132 }
 133
 134 int _bf_generate_mode_range(generator_context_t *ctx) {
 135
 136     if (ctx->key_length != BF_KEY_SIZE_32 && ctx->key_length != BF_KEY_SIZE_48) {
 137         return BF_GENERATOR_ERROR;
 138     }
 139
 140     if (ctx->current_key >= ctx->range_high) {
 141         return BF_GENERATOR_END;
 142     }
 143
 144     // we use flag1 as indicator if value of range_low was already emitted
 145     // so the range generated is <range_low, range_high>
 146     if (ctx->current_key <= ctx->range_low && ctx->flag1 == false) {
 147         ctx->current_key = ctx->range_low;
 148         ctx->flag1 = true;
 149         return BF_GENERATOR_NEXT;
 150     }
 151
 152     ctx->current_key++;
 153     return BF_GENERATOR_NEXT;
 154 }
 155
 156 int _bf_generate_mode_charset(generator_context_t *ctx) {
 157
 158     if (ctx->key_length != BF_KEY_SIZE_32 && ctx->key_length != BF_KEY_SIZE_48) {
 159         return BF_GENERATOR_ERROR;
 160     }
 161
 162     if (ctx->flag1) {
 163         return BF_GENERATOR_END;
 164     }
 165
 166     uint8_t key_byte = 0;
 167     ctx->current_key = 0;
 168
 169     for (key_byte = 0; key_byte < ctx->key_length; key_byte++) {
 170         ctx->current_key |= (uint64_t) ctx->charset[ctx->pos[key_byte]] << ((ctx->key_length - key_byte - 1) * 8);
 171     }
 172
 173     if (bf_array_increment(ctx->pos, ctx->key_length, ctx->charset_length) == -1) {
 174         // set flag1 to emit value last time and end generation on next call
 175         ctx->flag1 = true;
 176     }
 177
 178     return BF_GENERATOR_NEXT;
 179 }
 180
 181 int _bf_generate_mode_smart(generator_context_t *ctx) {
 182
 183     while (1) {
 184         if (smart_generators[ctx->smart_mode_stage] == NULL) {
 185             return BF_GENERATOR_END;
 186         }
 187
 188         int ret = smart_generators[ctx->smart_mode_stage](ctx);
 189
 190         switch (ret) {
 191             case BF_GENERATOR_NEXT: {
 192                 return ret;
 193             }
 194             case BF_GENERATOR_ERROR: {
 195                 return ret;
 196             }
 197             case BF_GENERATOR_END: {
 198                 ctx->smart_mode_stage++;
 199                 bf_generator_clear(ctx);
 200                 continue;
 201             }
 202         }
 203     }
 204 }
 205
 206
 207 int smart_generator_byte_repeat(generator_context_t *ctx) {
 208     // key consists of repeated single byte
 209     uint32_t current_byte = ctx->counter1;
 210
 211     if (current_byte > 0xFF) {
 212         return BF_GENERATOR_END;
 213     }
 214
 215     ctx->current_key = 0;
 216
 217     for (uint8_t key_byte = 0; key_byte < ctx->key_length; key_byte++) {
 218         ctx->current_key |= (uint64_t)current_byte << ((ctx->key_length - key_byte - 1) * 8);
 219     }
 220
 221     ctx->counter1++;
 222     return BF_GENERATOR_NEXT;
 223 }
 224 int smart_generator_msb_byte_only(generator_context_t *ctx) {
 225     // key of one byte (most significant one) and all others being zero
 226     uint32_t current_byte = ctx->counter1;
 227
 228     if (current_byte > 0xFF) {
 229         return BF_GENERATOR_END;
 230     }
 231
 232     ctx->current_key = (uint64_t)current_byte << ((ctx->key_length - 1) * 8);
 233
 234     ctx->counter1++;
 235     return BF_GENERATOR_NEXT;
 236 }
 237
 238
 239 int smart_generator_nibble_sequence(generator_context_t *ctx) {
 240     // patterns like A0A1A2A3...F0F1F2F3
 241     // also with offsets - A1A2A3, A2A3A4, etc
 242     // counter1 is high nibble (A, B, C), counter2 is low nibble (0,1, etc)
 243
 244     if (ctx->counter1 == 0) { // init values on first generator call
 245         ctx->counter1 = 0x0A;
 246     }
 247
 248     uint8_t key_byte;
 249
 250     // we substract %2 value because max_offset must be even number
 251     uint8_t max_offset = 10 - (ctx->key_length / 2) - (ctx->key_length / 2) % 2;
 252
 253     if (ctx->counter1 == 0x10) {
 254         return BF_GENERATOR_END;
 255     }
 256
 257     ctx->current_key = 0;
 258
 259     for (key_byte = 0; key_byte < ctx->key_length; key_byte++) {
 260         ctx->current_key |= (uint64_t) ctx->counter1 << (((ctx->key_length - key_byte - 1) * 8) + 4);
 261         ctx->current_key |= (uint64_t)(key_byte + ctx->counter2) % 10 << ((ctx->key_length - key_byte - 1) * 8);
 262     }
 263
 264     // counter 2 is the offset
 265     ctx->counter2++;
 266
 267     if (ctx->counter2 == max_offset) {
 268         ctx->counter2 = 0;
 269         ctx->counter1++;
 270     }
 271
 272     return BF_GENERATOR_NEXT;
 273 }